Privacy policy

Effective 27 October 2026 · Sprintbox · Kodana LTD

1. Who we are

Sprintbox is operated by KODANA LTD, a company registered in England and Wales, number 16633837. Contact us about privacy at info@sprintbox.sh.

This policy covers our website, dashboard, account administration, billing, support, and operation of our managed GitHub Actions runner service. Kodana LTD is the controller of personal data used for these purposes. If an organisation manages your workspace, it also controls its use of your information and the access it gives you.

Workflows can process personal data supplied by customers. Where we process that data solely on a customer's instructions, the customer is responsible for its lawful use and notices, and our processing must be covered by the applicable data processing agreement. Contact us before using Sprintbox for workloads that require such an agreement.

2. Information we handle

Account information: name, email address, account identifiers, workspace memberships, invitations, authentication settings, and records of sign-in and account changes. Passwords are stored as hashes, not as readable passwords.
GitHub integration and runner data: GitHub account and installation identifiers, repository names and identifiers, workflow and job metadata, runner configuration, status, timestamps, and usage records. Jobs can make source code, environment variables, secrets, dependencies, and other workflow content available to the runner. You control what your workflow supplies.
Billing: billing contact and address, invoices, usage charges, payment status, and payment-provider references. Stripe collects payment-card details through its payment interface; Sprintbox receives payment-method metadata rather than your full card number or security code.
Support and operations: messages you send us, IP addresses, request and authentication logs, technical errors, and service health information used to operate and protect the service.

We receive information directly from you, from your workspace administrators and workflows, automatically when you use the service, and from providers such as GitHub, Google, and Stripe when you use the corresponding integration. Required account, authentication, and billing information is necessary to provide the relevant service.

If you choose Google or GitHub sign-in when available, we receive your provider account identifier, name, and email information to create or identify your Sprintbox account and authenticate you. We use this data for sign-in, account security, and account communications. Google sign-in does not request access to your Gmail messages, Drive files, Calendar, or contacts. GitHub sign-in requests email access; repository access is managed separately through installation of the Sprintbox GitHub App.

We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Our use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect a linked sign-in provider in account settings when another sign-in method is available, or revoke access through that provider. Disconnecting sign-in does not itself delete your Sprintbox account or required billing records. Contact us to request deletion.

4. Why we use personal data

Providing the service: setting up accounts, authenticating users, running jobs, recording usage, billing, and responding to support requests. Our basis is performance of our contract with you, or our legitimate interest in providing the service to the organisation you represent.
Security and reliability: preventing abuse and fraud, investigating failures, managing access, and maintaining the service. Our basis is our legitimate interest in protecting users and operating a reliable service.
Legal and accounting duties: keeping required records and responding to lawful requests. Our basis is compliance with legal obligations.
Optional activities requiring consent: where we ask for consent, we explain the purpose when we ask. You can withdraw it without affecting processing that was lawful before withdrawal.

Information is made available to the providers needed to deliver the service, including GitHub for workflow integration, Ubicloud for managed runner infrastructure, Hetzner for hosting, Stripe for payments, Resend for transactional email, and Namecheap for domain and email-forwarding services. Google processes authentication requests when you choose Google sign-in. The information each provider receives depends on the function it performs.

Workspace administrators and other authorised members can see information their workspace permissions allow, such as membership, repositories, jobs, and usage. We may disclose information to professional advisers, where required by law, to protect legal rights or security, or in a business transfer subject to appropriate confidentiality and data-protection requirements. Providers may also act as independent controllers for their own services under their privacy policies.

6. International processing

Our providers may process information outside the UK, including in the European Economic Area and United States. A runner's location does not determine the location of all account, support, or payment processing. Where a restricted international transfer requires safeguards, we must use a lawful transfer mechanism, such as applicable adequacy regulations or approved contractual safeguards. Contact info@sprintbox.sh for information about the arrangements applicable to your data and how to obtain a copy.

7. Retention and deletion

We retain account and workspace information while needed to provide the service. Retention after closure depends on outstanding usage and payments, accounting and tax requirements, security investigations, disputes, and applicable limitation periods. Operational records are retained according to their troubleshooting and security purpose; backups and recovery copies may persist until their retention cycle expires. A deletion request does not immediately remove information from every backup or from records we must lawfully retain.

Runner environments are intended for temporary job execution, not long-term storage. Keep your source, artifacts, and backups in appropriate repositories or storage. GitHub-hosted logs, artifacts, and caches are governed by your GitHub settings and GitHub's retention rules. You can request account closure through the dashboard or contact us; workspace resources may need to be removed or transferred first.

8. Cookies and local storage

The dashboard uses cookies necessary for sessions, authentication, and security. Disabling these may prevent sign-in. The static marketing site does not include advertising or analytics scripts. GitHub, Google, and payment-provider pages may use their own cookies under their policies. We will provide any required choice before introducing optional tracking technologies.

9. Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction, or a portable copy of your personal data. You can object to processing based on legitimate interests, and to direct marketing at any time. These rights are subject to applicable legal conditions. We may need to confirm your identity before acting.

Send requests to info@sprintbox.sh. You can also complain to the UK Information Commissioner's Office or your local supervisory authority. We do not use personal data to make solely automated decisions with legal or similarly significant effects on individuals. Automated operational controls can enforce service access, usage, and payment requirements; contact us if you need a decision reviewed.

10. Updates

We will update this policy when our practices change and identify its effective date. We will bring material changes to users' attention through an appropriate service notice or account communication.